mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-07-15 17:16:07 +00:00
claude[bot]
fbad71d620
Second-pass review of the 54-commit self-correcting audit. Each item below was confirmed by reading the surrounding source (and, where practical, the pre-fix code) before being changed; regression tests are included for every behavioral fix. Concurrency: - eventbus: Bus.Subscribe called wg.Add with no synchronization against a concurrent Bus.Stop's wg.Wait, a real "WaitGroup misuse" panic risk (e.g. a Telegram-bot settings save racing panel shutdown/restart). Stop now flips a mu-guarded `stopped` flag before waiting, and Subscribe checks it under the same lock, so Add and Wait can no longer race. Security: - login_limiter: evictForRoom's fallback eviction picked an arbitrary map key, including ones still under an active cooldown - an attacker flooding /login with fresh usernames could evict their own (or anyone's) blocked record and reset the lockout. The fallback now skips actively-blocked records, only falling back to an unconditional evict if the map is somehow entirely full of active blocks (preserves the hard memory cap). Subscription-endpoint panics (reachable by any client hitting /sub): - internal/sub/service.go: applyPathAndHostParams/Obj (ws/httpupgrade/xhttp with no path settings object) and the TLS alpn readers in three places used unchecked type assertions - exactly the bug classabab7cd0patched elsewhere in the same switch statements, just not these call sites. - internal/sub/json_service.go, clash_service.go: the externalProxy loops in the JSON and Clash generators used unchecked assertions on a legacy/admin-supplied field (missing "port", non-object entry, etc.). - internal/sub/json_service.go: realityData's shortId/serverName selection could assert a non-string array element. Other correctness: - client_traffic.go: ResetAllTraffics (touched by3eb214d0) still skipped clearing NodeClientTraffic node-sync baselines, unlike its sibling reset paths in the same file - a node's next sync would re-add pre-reset delta on top of the freshly-zeroed counter. - inbound_traffic.go: the traffic-tick tx's Commit/Rollback errors were silently discarded; now logged so a backend-level commit failure (e.g. an aborted Postgres tx from a best-effort helper) doesn't masquerade as a successful tick. - outbound_subscription.go: the new subscriptionFetchClient doc comment was wedged between fetchAndStore's existing comment and fetchAndStore itself, leaving fetchAndStore undocumented and the comment describing the wrong function. Convention cleanup: - Removed narrative // comments added by the audit that violate this repo's no-inline-comment rule (mostly narrating the specific bug/fix rather than a lasting contract, and mostly on new Test functions, which this repo's existing tests never comment) - calibrated against this exact codebase's own pre-existing comment style so legitimate godoc-style doc comments were left alone.
95 lines
3.2 KiB
Go
95 lines
3.2 KiB
Go
package service
|
|
|
|
import (
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
|
|
"gorm.io/gorm"
|
|
|
|
"github.com/mhsanaei/3x-ui/v3/internal/database/model"
|
|
"github.com/mhsanaei/3x-ui/v3/internal/xray"
|
|
)
|
|
|
|
func TestAddTrafficCommitsDespiteDisableHelperError(t *testing.T) {
|
|
db := initTrafficTestDB(t)
|
|
svc := &InboundService{}
|
|
|
|
normal := &model.Inbound{UserId: 1, Tag: "in-normal", Enable: true, Port: 43001, Protocol: model.VLESS, Settings: `{"clients":[]}`}
|
|
if err := db.Create(normal).Error; err != nil {
|
|
t.Fatalf("seed normal inbound: %v", err)
|
|
}
|
|
expired := &model.Inbound{UserId: 1, Tag: "in-expired", Enable: true, Port: 43002, Protocol: model.VLESS, ExpiryTime: 1, Settings: `{"clients":[]}`}
|
|
if err := db.Create(expired).Error; err != nil {
|
|
t.Fatalf("seed expired inbound: %v", err)
|
|
}
|
|
|
|
const cbName = "b2-03:fail-disable"
|
|
if err := db.Callback().Update().After("gorm:update").Register(cbName, func(tx *gorm.DB) {
|
|
if tx.Statement != nil && tx.Statement.Table == "inbounds" &&
|
|
strings.Contains(tx.Statement.SQL.String(), "expiry_time") {
|
|
tx.AddError(errors.New("injected disableInvalidInbounds failure"))
|
|
}
|
|
}); err != nil {
|
|
t.Fatalf("register callback: %v", err)
|
|
}
|
|
t.Cleanup(func() { _ = db.Callback().Update().Remove(cbName) })
|
|
|
|
if _, _, err := svc.AddTraffic([]*xray.Traffic{{IsInbound: true, Tag: "in-normal", Up: 500, Down: 700}}, nil); err != nil {
|
|
t.Fatalf("AddTraffic: %v", err)
|
|
}
|
|
|
|
var reloaded model.Inbound
|
|
if err := db.Where("tag = ?", "in-normal").First(&reloaded).Error; err != nil {
|
|
t.Fatalf("reload normal inbound: %v", err)
|
|
}
|
|
if reloaded.Up != 500 || reloaded.Down != 700 {
|
|
t.Fatalf("traffic tick was rolled back by a best-effort disable-helper error: up=%d down=%d, want 500/700", reloaded.Up, reloaded.Down)
|
|
}
|
|
}
|
|
|
|
func TestResetAllTrafficsReenablesDepletedClients(t *testing.T) {
|
|
db := initTrafficTestDB(t)
|
|
svc := &ClientService{}
|
|
|
|
if err := db.Create(&xray.ClientTraffic{InboundId: 1, Email: "spent@x", Enable: false, Up: 60, Down: 60, Total: 100}).Error; err != nil {
|
|
t.Fatalf("seed: %v", err)
|
|
}
|
|
|
|
if _, err := svc.ResetAllTraffics(); err != nil {
|
|
t.Fatalf("ResetAllTraffics: %v", err)
|
|
}
|
|
|
|
row := readTraffic(t, db, "spent@x")
|
|
if row.Up != 0 || row.Down != 0 {
|
|
t.Fatalf("usage not reset: up=%d down=%d", row.Up, row.Down)
|
|
}
|
|
if !row.Enable {
|
|
t.Fatal("a depleted client must be re-enabled after Reset All Client Traffic, matching every other reset path")
|
|
}
|
|
}
|
|
|
|
func TestResetAllTrafficsClearsNodeBaselines(t *testing.T) {
|
|
db := initTrafficTestDB(t)
|
|
svc := &ClientService{}
|
|
|
|
if err := db.Create(&xray.ClientTraffic{InboundId: 1, Email: "spent@x", Enable: true, Up: 60, Down: 60, Total: 100}).Error; err != nil {
|
|
t.Fatalf("seed traffic: %v", err)
|
|
}
|
|
if err := db.Create(&model.NodeClientTraffic{NodeId: 1, Email: "spent@x", Up: 60, Down: 60}).Error; err != nil {
|
|
t.Fatalf("seed node baseline: %v", err)
|
|
}
|
|
|
|
if _, err := svc.ResetAllTraffics(); err != nil {
|
|
t.Fatalf("ResetAllTraffics: %v", err)
|
|
}
|
|
|
|
var cnt int64
|
|
if err := db.Model(&model.NodeClientTraffic{}).Where("email = ?", "spent@x").Count(&cnt).Error; err != nil {
|
|
t.Fatalf("count baselines: %v", err)
|
|
}
|
|
if cnt != 0 {
|
|
t.Fatalf("Reset All Client Traffic must clear node baselines like its sibling reset paths, found %d", cnt)
|
|
}
|
|
}
|